PHP, Node.js, eMudhra, and LiteLLM lead busy week for security teams

Four security incidents landed between October 20 and 22, 2026, and together, they touch most of the modern web stack: the PHP runtime, a public certificate authority, the Node.js runtime and a popular Python AI library. 

Two are classic vulnerabilities fixed by patches (PHP and Node.js). Two are trust failures in the supply chain: weak keys behind publicly trusted certificates at eMudhra, and a hijacked release pipeline at LiteLLM.

According to researchers and vendor statements, three of the four incidents involved AI-assisted tooling, and two were complicated by early disclosure or information leaks. 

In the same window, GitLab, Fortinet and Oracle shipped major fixes of their own. 

PHP is the server-side scripting language behind a large share of websites, including WordPress, Drupal, Joomla, Magento, MediaWiki, phpMyAdmin, Nextcloud and apps built on Laravel or Symfony. 

What happened. On October 21 the PHP project shipped an emergency release for two critical flaws, CVE-2026-109618 and CVE-2026-109619, nicknamed “PHP2Shell”. Both are rated 9.2 (CVSS v4.0) and allow an unauthenticated attacker to run code on the server. Every PHP version from 5.4 through 8.5.11 is affected, according to Wiz Research. 

How it works. An attacker sends a crafted upload request that inflates memory use until PHP hits its memory_limit at a chosen moment. The resulting fatal error interrupts PHP halfway through building internal data, and later cleanup code trusts that half-built or already-freed data. The researchers at Calif say they confirmed pre-authentication code execution against WordPress, Drupal, Joomla, Magento, phpMyAdmin, Nextcloud, Laravel and others. 

Who is affected. Any PHP install that serves web requests: Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. The fallout went well beyond IT teams. In Japan, Mizuho halted bank and securities services, All Nippon Airways disabled Apple Wallet boarding passes, and Japan Airlines, JR East and Seven-Eleven Japan took some web services down; in France, Orange suspended some sites (TNW). Officials in Germany and Japan said they had not seen a successful attack. The Dutch NCSC initially said the same, but on October 22 reported its first signals of successful exploitation (NOS).

PHP Branch	Fixed Release
8.5	8.5.12
8.4	8.4.27
8.3	8.3.36
8.2	8.2.35

CISA said organizations that are still on PHP 8.1 or older, unsupported versions should take those systems offline until they can upgrade. The PHP project’s own release notes say there are no complete mitigations and updating is the only safe choice. 

What eMudhra is. eMudhra is an Indian digital-trust company and a publicly trusted certificate authority (CA), sold under the emSign brand. Its products include SSL/TLS certificates, the emSigner e-signature platform, the CertiNext certificate-management tool and the SecurePass identity platform. A CA vouches for websites: if a browser trusts the CA, it trusts every certificate that CA signs. 

What happened. Eight eMudhra intermediate CAs (six for TLS, two for code signing) were created in an April 2025 key ceremony with private keys that were single-byte numbers. Researcher Scott Helme recovered all eight on a laptop in under a second; one key was simply the number 4. All eight had also been cross-signed by Sectigo’s AAA Certificate Services root. 

A researcher reported the problem to Apple, Google, Microsoft, Mozilla and eMudhra on October 17. Chrome and Firefox pushed blocks that same evening without needing a browser update, and Mozilla is removing the eMudhra root that signed them. In its own statement, eMudhra says the keys were generated on FIPS 140-2 Level 3 hardware security modules, but a faulty key wrap/unwrap step created a second, weak key set that ended up in the published certificates. The error went unnoticed for about 18 months and two audit cycles. 

Who is affected. eMudhra says the eight intermediates never issued a certificate, and that the root distrust affects only one customer ecosystem in the United States. Its e-signature, emSigner, CertiNext, SecurePass and other products run on separate infrastructure and are unaffected, the company says. 

The wider risk sits outside browsers. Because the keys are now public, anyone can forge a certificate for any website using these intermediates. Helme showed that curl, Python and 

Node accepted a forged api.stripe.com certificate with default settings, because most non-browser clients trust a CA file on disk and do not check revocation or Certificate Transparency. That covers CI/CD runners, server-to-server API calls, installers, IoT devices with frozen firmware, and Windows code signing, where malware signed with the two code-signing keys could look legitimate. 

What to do. Update everything that ships a CA bundle: OS ca-certificates packages, Python’s certifi, Node.js (see below), Go, Composer’s ca-bundle, and rebuild container images once base images pick up the change. 

Go needed its own emergency fix. Go does not check revocation, so Go 1.27.3 and 1.26.10 now hard-code a block on the eight keys (CVE-2026-111943). Because Go programs compile the standard library into each binary, every Go-built tool has to be rebuilt to get the fix. Projects such as Atlantis, Docker Buildx and Buildkite’s test client shipped emergency rebuilds on October 20 and 21; Atlantis noted that older builds would have accepted a forged certificate for the code-hosting APIs it sends credentials to. 

What Node.js is. Node.js is the open-source JavaScript runtime used to run web servers, APIs, command-line tools and build pipelines outside the browser. It powers backends at companies of every size and sits underneath frameworks such as Next.js and Express. 

What happened. On October 21 the Node.js project released 22.23.4, 24.22.1 and 26.12.1, fixing 10 vulnerabilities. The most serious, CVE-2026-111497 (high), is an out-of-bounds write in the Brotli decompression library that Node.js bundles; the project says it permits remote code execution. The bug was reported by Khai Tran and Sylvie Mayer of OpenAI Codex Security. 

Three other high-severity fixes cover TLS hostname checks that can be bypassed with oddly written IP addresses (CVE-2026-106069, CVE-2026-105483) and dns.resolve truncating names at a NUL byte (CVE-2026-105482). The release also blocks the eight compromised eMudhra intermediates and removes three emSign roots from Node’s bundled certificate list. 

Who is affected. Any app on Node.js 22, 24 or 26 that decompresses Brotli data an attacker controls, either through node:zlib or automatically when fetch() receives a Brotli-compressed response (The Hacker News). Node.js 20 and older are end of life and get no fix. Other software that bundles Google’s Brotli library may need Brotli 1.2.1, 1.1.1 or 1.0.10. 

How serious in practice. A public proof-of-concept published October 22 achieved code execution only against a deliberately weakened test build; on a standard build it caused a crash and a limited memory read. No exploitation in the wild had been reported as of October 22. There is no workaround inside Node.js, so upgrading is the fix. 

What LiteLLM is. LiteLLM is an open-source Python library and AI gateway that lets developers call 100+ large language model providers through one interface. Teams run it as a proxy that stores their provider API keys, tracks spend and routes requests. Datadog Security Labs puts it at about 23 million weekly downloads. 

What happened. On October 21, attackers used LiteLLM’s own release pipeline to publish a malicious version, 1.107.0, to PyPI and Docker. According to LiteLLM’s incident report, the package carried compiled malware that steals credentials and loads remote-code-execution tools. It drops cook.pth and sitecustomize.py into site-packages, so it runs every time Python starts, even if the app never imports LiteLLM. 

The attackers held GitHub CLI tokens from three developers. They used an organization owner’s token to override branch protection, pointed the release workflow at a lookalike repository (Berri-AI/litellm instead of BerriAI/litellm), and let the real pipeline sign and publish the result. A third account then deleted the workflow run records. LiteLLM said it believes the tokens came from logs in an internet-exposed internal LiteLLM deployment, and says it observed situations where Claude Code embedded a user’s GitHub CLI token in a response body that ended up in those logs. This is the project’s second supply chain compromise this year, after malicious versions 1.82.7 and 1.82.8 in March. 

Channel	Affected	Window(UTC, Oct 21)
PyPi	litellm==1.107.0, all seven wheels	11:39 to 13:23
Docker Hub	v1.107.0, latest, main-latest, main-stable	11:46 to 14:20
GHCR	same tags, plus litellm-database and litellm-non_root	11:46 to 13:51

Anyone who installed an unpinned LiteLLM or pulled those tags in that window, including CI runners and proxy containers, should assume any accessible secrets may have been exposed and rotate credentials accordingly. Customers on LiteLLM’s private enterprise registry were not affected. 

What to do. Do not run pip first, because any Python start re-triggers the malware. Delete the dropped files from the shell, kill the background loader, rebuild from scratch pinned to litellm==1.106.2, then rotate cloud roles, every provider key stored in the LiteLLM database, master and virtual keys, and database passwords. 

Context: GhostAction. LiteLLM is not the only project losing GitHub credentials this month. On October 8 and 9, the GhostAction campaign used about 1,900 hijacked GitHub accounts to push credential-stealing workflows, disguised with names like security-audit.yml, into more than 30,000 repositories, and tried to extract 3,174 CI secrets (The Hacker News). GitHub began blocking the workflow on October 9. Some victims had been hit in earlier waves, which suggests the attackers rely on secrets that were never rotated. 

GitLab: a CVSS 10.0 flaw reaching back to 2014. GitLab is the self-hostable platform many companies use for source code, CI/CD pipelines and code review. On October 21 it fixed CVE-2026-110264, which lets an unauthenticated attacker run code on a self-managed server through an integer overflow when compiling a crafted regular expression. Every version since 7.0 (2014) is affected, because the bug sits in the Onigmo regex engine GitLab ships in its packages. GitLab.com and Dedicated tenants are already patched; self-managed admins should move to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13. No attacks have been reported. Admins who patched on October 12 for a related regex flaw are back in range and need this update too. 

Fortinet: AI-found flaws, details held back until November. Fortinet makes the FortiGate firewalls and management tools that sit at the network edge of many companies and governments. On October 22 it shipped fixes for critical and high-severity flaws in FortiOS, FortiManager, FortiAnalyzer, FortiMail and FortiAuthenticator, some found through AI-assisted testing with help from Anthropic, OpenAI, Google and SpaceX (Cyber Security News). Fortinet is withholding CVE numbers and technical details until November 10, while warning that attackers can use AI to diff patched and unpatched firmware and build exploits within hours or days. No exploitation has been reported. FortiOS users should move to 8.0.2, 7.6.8, 7.4.13 or 7.2.14, and internet-facing devices come first. 

Oracle: a routine but heavy quarterly update. Oracle’s October Critical Patch Update arrived on October 20 with roughly 1,300 security patches across products such as Oracle Database, APEX and Fusion Middleware (Oracle). One count puts it at 1,295 fixes, 95 of them critical, with Fusion Middleware receiving the most and many exploitable remotely without authentication (OffSeq, citing SecurityWeek). For teams already patching PHP, Node.js and GitLab, it adds to the same week’s workload. 

The pattern: AI finds old flaws faster, and attackers move within hours 

Three patterns repeat across the four incidents: AI tools sped up discovery, the underlying flaws were old or already half-known, and attackers went after trust infrastructure and credentials rather than single apps. 

Incident	How it was found	AI’s role	How long the flaw sat	Exploitation as of Oct. 22
PHP2Shell	Calif audit under OpenAI’s Patch the Planet, with Wiz	LLM used to find the bug and generalize it into a search pattern	Earliest path dates to PHP 5.4; related bug reported 2020 and flagged in a 2024 audit	Attempts from Oct 17; millions after release; no confirmed break-in
eMudhra CA keys	Independent researcher, reported Oct 17	Reportedly AI-assisted; Helme says one AI prompt recovered the keys	About 18 months, through two audits	Keys now public; no confirmed misuse
Node.js Brotli	OpenAI Codex Security researchers	AI security tool credited with the report	Fix sat in Brotli’s public source from February to October	PoC crashes standard builds; no attacks reported
LiteLLM 1.107.0	Community researcher helped detect the poisoned release	LiteLLM says tokens leaked via an AI coding tool’s logged responses	Unknown; exposed internal deployment	Malware live for about 2 hours on PyPI

AI is now on both sides of discovery. OpenAI-backed teams found PHP2Shell and the Brotli bug, and the eMudhra keys fell to what eMudhra calls AI-assisted tooling. Fortinet says some of its October 22 fixes also came from AI-assisted testing. Calif’s researcher notes that LLMs did not find the PHP bug on their own: he steered the model toward a 2004-era bug class he already knew. 

Known-but-unfixed is the common thread. PHP’s 2024 audit found a related out-of-memory issue but did not fix it because exploitation was not proven. eMudhra’s weak keys passed two audits. The Brotli fix was visible in public source code eight months before a security release. GitLab’s CVSS 10.0 flaw reaches back to 2014 because it lives in a regex engine GitLab has bundled ever since. 

Attackers aim for the next hop. The LiteLLM malware targeted cloud roles and AI provider keys, eMudhra’s keys could forge certificates for any site, and the PHP2Shell targets include CMSs and admin panels holding customer data. In each case the prize is access to other systems, not the vulnerable component itself. The GhostAction campaign, which hijacked about 1,900 GitHub accounts earlier in October, went after the same CI and cloud secrets. 

PHP2Shell suffered the worst communication breakdown of the four: a leak forced an early release, an embargo dispute followed, and official sources disagreed on whether attacks were working. The other three saw smaller mismatches between vendor statements, researchers and headlines. 

• Details leaked on social media on October 20, two days before the planned October 22 disclosure; the original poster said the claim was unconfirmed (watchTowr). PHP pulled the release forward to October 21 at 14:00 UTC. 
• The PHP Foundation says Chainguard broke the embargo by publishing patched images more than six hours early. Chainguard’s CEO denies leaking and says it shipped because people were already being hit (TNW). Early patched builds hand attackers a diff to study. 
• Amazon saw an exploit attempt on October 17, during the embargo, and its CISO said it was unclear how the attacker got the details. 
• Messages on exploitation conflicted. Amazon called PHP2Shell broadly exploited and Cloudflare counted millions of attempts, while CISA, Germany’s BSI and the PHP Foundation said they had seen no successful attack. The Dutch NCSC reversed itself within a day, moving from no signs of abuse to first signals of successful exploitation, without saying what those signals were. Banks, airlines and telecoms in Japan and France took services offline anyway. 
• Partial workarounds spread online, but PHP’s own release notes say there are no complete mitigations. 

• Mozilla says it received the report on October 17 at 20:06 UTC; eMudhra says it learned of the issue late on October 18, India time, and revoked on October 19 (eMudhra). 
• eMudhra’s October 20 update called the removal of two of its roots from Mozilla voluntary and unrelated. Its October 21 update then confirmed browsers had distrusted its ECC root because of this incident. 
• eMudhra describes the impact as contained to one US customer. On Mozilla’s discussion thread the keys were described as weak enough that the issue cannot be contained, since anyone can now forge certificates against unpatched clients (Scott Helme). 
• eMudhra also had to rebut online claims that it had not used hardware security modules at all. 

Node.js: severity labels and headlines ran ahead of the evidence. Some coverage described the Brotli proof-of-concept as an exploit demonstrated “in the wild” (Cybernews), but it only crashed standard builds. Node.js rated one TLS flaw high even though the commit that fixed it calls the bug low-severity and hard to exploit. 

LiteLLM: “contained” before the facts were in. The incident post was titled “Contained” while the attack chain was still unconfirmed, and the attackers deleted the workflow logs investigators needed. The post also revealed that a separate, embargoed LiteLLM vulnerability is due for disclosure on October 27, with a fix already shipping privately to enterprise customers. That tells attackers a known, unfixed flaw exists in the open-source version. LiteLLM’s claim that Claude Code exposed GitHub tokens in logs is the project’s own account and had not been independently confirmed in the sources reviewed. 

☐ Upgrade PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or take unsupported PHP offline 

☐ Upgrade Node.js to 22.23.4, 24.22.1 or 26.12.1 and restart every Node process 

☐ Refresh CA bundles (OS ca-certificates, certifi, Go, Composer) and rebuild container images 

☐ Rebuild or update Go-built tools with Go 1.27.3 or 1.26.10 

☐ Check for litellm==1.107.0 or the affected Docker tags; if found, rebuild and rotate every reachable secret 

☐ Audit repositories for unexpected workflow files such as security-audit.yml and rotate CI secrets 

☐ Patch self-managed GitLab, including instances updated on October 12 

☐ Install Fortinet’s October 22 firmware, internet-facing devices first 

☐ Schedule Oracle’s October Critical Patch Update 

☐ Pin dependency versions and image digests instead of latest 

Sources: